OAuth for your MCP server. Ship it today, not next quarter.

How it works

1. 1

   npm install getmcpauth

   Add the SDK to your MCP server project. Peer dependencies are @modelcontextprotocol/sdk and express.

2. 2

   Wrap your server with mcpAuth()

   One middleware call protects your MCP route. It wraps the official SDK's requireBearerAuth middleware, so bad or missing tokens get a spec-correct 401 before they ever reach your handlers.

3. 3

   Clients auto-discover the rest

   GET /.well-known/oauth-authorization-server lists every endpoint mcpauth exposes — registration, authorize, token, revoke, introspect — so an MCP client only needs your base URL.

Before and after

Most MCP servers today either skip auth entirely or check a static key with a middleware like this:

// Hand-rolled API key check
app.use("/mcp", (req, res, next) => {
  const key = req.headers["x-api-key"];

  if (!key || key !== process.env.MCP_API_KEY) {
    return res.status(401).json({ error: "unauthorized" });
  }

  // No scopes, no per-user identity, no token
  // expiry, no revocation, no discovery for
  // clients that expect real OAuth.
  next();
});

With mcpauth, the same protection — plus real per-user identity, scopes, token expiry, and revocation — is three lines:

// mcpauth
app.use(
  "/mcp",
  mcpAuth({ registrationSecret: process.env.MCPAUTH_SECRET })
);

Test it live, before you install anything

This isn't a mock. It's a real MCP server, in production, protected by mcpauth's own published SDK — the same package you'd install. Point the official MCP Inspector at it:

npx @modelcontextprotocol/inspector \
  https://getmcpauth.dev/api/demo/mcp --transport http

Inspector hits the server, gets a 401 with a WWW-Authenticate header pointing at mcpauth, registers itself automatically (Dynamic Client Registration — no client ID to configure), and walks you through the real GitHub-login consent screen in your browser. Approve it, and Inspector can call the two tools this demo server exposes — a live, end-to-end proof of the whole flow.

Who it's for

Already have users? Skip the consent screen entirely

If you're bolting an MCP server onto a product that already has its own login, don't make your users authenticate twice. Your backend, which already knows who's signed in, mints the token directly:

1. Your user logs into your product, as usual — not mcpauth.
2. Your backend calls mintToken() (or /api/oauth/token/exchange directly), server-to-server, vouching for that user.
3. The resulting token is handed straight to the MCP client — no GitHub login, no browser redirect, no separate consent screen.

import { mintToken } from "getmcpauth";

// After your own login/session check —
// mcpauth never authenticates this user itself.
const { accessToken } = await mintToken({
  registrationSecret: process.env.MCPAUTH_SECRET,
  clientId,
  subject: currentUser.id,
  scopes: ["read:files"],
});

// Hand accessToken to the MCP client. No
// GitHub login, no consent screen — your
// backend already vouched for this user.

Full server-to-server token minting docs →

Pricing

See full pricing details →

See how mcpauth compares to Descope, Auth0, Stytch, and WorkOS →